I am new to wireshark and I can't capture http packets. I tried troubleshooting and added a decryption key containing my password followed by my SSID with a colon on the middle under 802.11 in the protocol preferences. I still can't capture http packets. Please help.
Be sure you cover the 'gotchas' from the wiki.
I'm having trouble understanding it. Could you simplify it for me?
For WPA and WPA2, you not only have to supply a password, you also have to ensure that Wireshark captures the initial setup of encryption ("EAPOL handshake") for each machine whose traffic you want to capture.
If you're only trying to capture traffic to and from the machine running Wireshark, it's easier if you don't capture in monitor mode - no decryption necessary.
Otherwise, you're going to have to disconnect each machine from the network and reconnect it (making the device sleep - including "shutting off" a smartphone or tablet - will probably be sufficient) while Wireshark is capturing traffic.
For WPA3, it's apparently extremely difficult, if not impossible, to do decryption in a sniffer; Wireshark doesn't support decrypting WPA3, just WPA and WPA2 (and WEP).
Remember - the whole purpose of WEP and WPA is to make it hard to sniff Wi-Fi networks!
Comments